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The Internet itself is a worldwide network connecting millions of computers 
and less significant networks. Computers communicated by routers. Crucial 
the role of a router is to our technique of communicating and computing. 
Routers are situated at gateways, the spaces where two or more networks 
connect, and are the decisive device that keeps data flow between networks 
and keeps the networks connected to the Internet. When data is sent between 
places on one network or from one network to a second network the data is 
always seen and intended for to the proper place by the router. The router 
carries out this by using headers and routing tables to establish the best path 
for routing the data packets. This trim down the effectiveness of edge router 
only when the path engaged, it will enhanced by classification method, 
predictable classification methods like port based ,deep packet inspection and 


statistical classification are give less precision. In this system structured 
optimized neural network is used for more precise organization. 
Classification output forwarded to router dynamically for intellectual packet 
delivery. The method will improve router competence by greater than before 
throughput and decreased latency. 
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1. INTRODUCTION 

Lakhina et al. [1] explained the distributions of packet features observed in flow a trace which 
reveals both the presence and the structure of a wide range of anomalies. Using entropy a summarization tool 
that the method expressed that the analysis of feature distributions leads to significant advances using feature 
distributions, anomalies naturally fall into distinct and meaningful clusters. Estan et al. [2] introduced 
scalable algorithms for identifying the large flows: sample and hold and multistage filters, which take a 
constant number of memory references per packet and use a small amount of memory. The technique 
described optimizations such as early removal and conservative update that further improve the accuracy of 
algorithms, as measured on real traffic traces, by an order of magnitude. Peng el al. [3] expressed Energy 
efficient clustering using energy prediction mechanism. They have used different energy level sensors with 
different monitoring objects. For cluster head selection residual energy of nodes is predicted instead of 
broadcasting it in every round, also they used communication cost. 

Nguyen et al. [4] designed K-Means clustering algorithm for packet separations. Packets traced in 
computer networks. From traced packets flow is defined, and flows are grouped into clusters. Flows 
classified based on k-cluster centers. The cluster centers are defined by packet length and packets arrival time 
of application. Applications which are having same packet length or nearby packet length are compared with 
existing cluster, if it is matched combined to existing cluster otherwise new cluster group if formed. In 
machine learning SVM it uses supervised learning algorithm and analyze data used for classification and 
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regression. If no trained set that method is called unsupervised algorithm, here input flows are grouped as 
clusters. 

There are two types of SVM. 

1. Linear SVM and 

2. Non- linear SVM. 

Linear SVM: In linear SVM, it has linear n-dimensional vector and if there is a possibility of separating n-1 
hyper plane vector it is called a linear classifier. The hyper plane is used to classify data and optimal hyper 
plane will give largest separation or, Bad selection of hyper plane will give noise data classification. Distance 
of data compared with hyper plane so maximum value stetted for it. 

Non-Linear SVM: In non-linear SVM, the classifier is created by applying the kernel trick to maximum- 
margin hyper planes. They are effective in high dimensional spaces. They are still effective in cases where 
number of dimensions is greater than the number of samples. It uses a subset of training points in the decision 
function and so it is memory efficient. SVM has some disadvantages. Particularly, if the number of features 
is much greater than the number of samples, the method is likely to give poor performance. They do not 
directly provide probability estimates, these are calculated using an expensive five-fold cross-validation. 
ONE-CLASS SVM: Another alternative of SVM is one-class SVM. It is an unsupervised algorithm that 
learns a decision function for novelty detection that it classifies new data as similar or different to the training 
set. Basically, it also separates all the data points from the origin and maximizes the distance from this 
hyperplane to the origin. The optimal hyperplane is the one that represents the largest separation, or margin, 
between the two classes. If the number of samples is more than the creation of optimal boundary is difficult 
and it performance is also affected. It uses only unsupervised algorithm. Hence, it cannot identify new traffic. 

Moore et al. [5] designed machine learning Naive Bayes technique to categorize internet traffic 
based on application. The traffic in the internet applications were classified into different categories, e.g. 
mail, web services, p2p, multimedia and games. The authors used accuracy as a classification metric to 
evaluate performance of classifier. This result depicted that naive bayes techniques have 65 % accuracy in 
classification. Two refinements were performed for improving classification accuracy using naive bayes 
kernel estimation and fast correlation based filter method. It gives 95% as the overall accuracy. 

Luigi et al. [6] designed SeLeCT technique, a Self-Learning Classifier for Internet Traffic. It uses 
unsupervised algorithm to automatically groups the flow into homogeneous group based on application. It 
doesn’t require prior knowledge of training set to identify the traffic flows. Automatically the algorithm 
groups the flows into homogeneous clusters using statistical features. It also simplifies the label assignment 
by assigning labels to the cluster based on application. Furthermore, it uses self seeding approach to process 
next batches of flows before assigning labels to previous cluster. The author evaluated the performance of 
SeLeCT using different traffic traces collected from ISP located in the different continents. The experiments 
showed that it achieves overall accuracy .The accuracy is achieved is nearly 98% and it discover new 
protocols and application in the traffic traces. 

Bujlow et al. [7] discussed, C5.0 is the decision tree based algorithm and use the concept of machine 
learning algorithm. It is easier to use and memory efficient. It generates the decision tree based on set of 
training set .The trees are used to classify the set of test cases. The c5.0 classifier uses command line 
interface to generate the rules for decision tree and test the classifier. The experiment was executed many 
times using different set of training flows and attributes like packet size, packet length, number of flows. The 
attributes for flows are used to construct test cases. It produced 98% accuracy when accurate testing and 
training data used. Karagiannis et al. [8] introduced a more general classification system that groups the 
flows using host and port information then individual flows, this system works on payload details, flows are 
trained by payload, it gives less accuracy, if port and host information is unavailable. 

Roughan et al. [9] classified the traffic into an undersized number of types apt for Qos applications. 
They use system such as clustering using nearest neighbor to give the necessary arrangement. Some degree 
of small set of features and an implicit assumption of the accuracy of the testing and training data-sets; the 
authors restrict themselves large sets of network-based applications. Afzal et al. [10] compared the 
performance of two variations of back propagation learning algorithm (Adaptive learning rate with 
momentum and Resilient). Both the algorithms are experimented on a variety of classification problems in 
order to assess the efficiency of these two learning approaches. Experimental results reveal that during testing 
and training Resilient propagation algorithm outperforms back propagation with Adaptive learning rate and 
momentum. 

Hemalatha et al. [11] expressed the privacy-preserving methods was vulnerable to Sybil attacks, 
whereby a malicious user can act as to be multiple vehicles. It ensured the authenticity of the messages 
propagated in VANET; a straight-forward process is utilized public keys authorized by a certification 
authority (CA) to sign the messages. Fadli et al. [12] developed an Ethernet over SDH (synchronous digital 
hierarchy) and MPLS-TP (Multiprotocol Label Switching - Transport Profile) with ring security to 
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predictable network failure and computed performance of network. Aman et al. [13] integrated context 
transport and multicast quick reroute, and developed this integration to the standard network mobility 
management. Hashim et al. [14] discussed quantitative analysis and it computed Proxy Mobile Internet 
Protocol Version 6 (PMIPv6) multicast speedy reroute operations for data traffic. 

Router routes the packets from one network to other network through the best path. To route the 
packet router must know the following details target address, neighbor router from which it can learn about 
remote networks possible routes to all remote networks. The best route is applied to each remote network and 
how to maintain and verify routing information. The router learns about remote networks from neighbor 
router or from an administrator, the router then builds a routing table that describes how to find the remote 
network, if a network is directly connected then the router already knows how to get to it. If a network isn’t 
directly connected to the router, the router use two ways to reach remote network one is static routing and 
other is dynamic routing. 

The Network traffic classification is required mainly for many network management tasks. Flow 
prioritization Traffic shaping/policing diagnostic monitoring. Also the network operators can know 
knowledge of what applications are present in a network, network-operators are superior to plan, budget and 
bill. Network-operators and users able to identify abnormality in network traffic to reduce the impact of 
malicious behavior. Beside classification of network traffics are those that define to understand the present 
and varying Internet: the modeling of traffic-mix, user-composition and so on. In neural network 
classification depend without knowing site detail, which machine used, without interaction of user and 
administrator and without packet payload information like IP address and port detail. 

This paper summarize as follows: Section 2 discussed about proposed method. Section 3 explores 
about implemented result and Discussion. Section 4 concludes the overall work with future plan of research 
work. 


2. PROPOSED SYSTEM 

Neural network is a conceptual model designed as a computational model based on human brain to 
solve certain kind of problems, it’s a network of many neurons and performs intelligent behavior, and neural 
network has ability to learn an adaptive system which means it can change network structure based on 
information flowing through it. Adaptation is done by adjusting weights of network. 


Input Hidden Layer Output 


we 








Figure 1. Sample Architecture of Neural Network 


In Figure | circle represents the neurons and lines indicates connection between two neurons also it 
is a path for flow of information, each line has weight it’s a number that control action between two neurons. 
If the neural network gives good output no need to adjust the weights, otherwise error generated by network. 
So the weights are adjusted to get good output. A perceptron contains one or more inputs or a processor and 
produce the single output, it follows the feed forward model which means inputs are sent to neurons are 
processed to get output. 

Perceptron algorithm 

Step 1: all inputs are multiplied by weights 

Step 2: sum all the weighted inputs 

Step 3: compute the output by sum passed through an activation function. 
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2.1. Back Propagation with Neural Network (BPNN) 

The BPNN is a common method for training the artificial neural networks in conjunction with an 
optimization method, such as the gradient descent. The method calculates the gradient of a loss function with 
respects to all the weights in the network. The gradient is fed to the optimization method which in turn uses it 
to update the weights, in an attempt to minimize the loss function. Back propagation (BP) requires a known, 
desired output for each input value in order to calculate the loss function gradient. It is therefore usually 
considered to be a supervised learning method. Although, it is also used for some unsupervised network. It is 
a generalization of the delta rule to multi-layered feed forward networks, made possible by using the chain 
rule to iteratively compute gradients for each layer. The BP requires that the activation function used by the 
artificial neurons (or “nodes”) be differentiable. 

Given the number of nodes of the input layer, the hidden and the output network n, k, m, 


respectively, the total number of input samples is X pi? which indicates that the P sample’s the ith input value, 


V,, indicates the ith node of input layer to the hidden layer of the kth node weight, @ ,, means the node weight 


from hidden layer ofthe k to the output layer of the j. For convenience, the threshold is included connection 
weights, and then the output of hidden layer node k is expressed in equation (1). 


Ze = Sf (Net Jaf [Svar (1) 


i=0 


The output layer nodes for the node j: is expressed in equation (2). 


Yi = f (net, )= #(Smeen | 





(2) 
where, standard sigmoid function is selected as incentive function are given equation(3). 
f@)= 
(3) 
The definition of global error functions can be expressed in equation (4). 
P row 
E= DE, = papa Yo) 
p=l p=! j=l ( 4) 


where Be is error of the sample p, ty) is the ideal output. The adjustment formulas of weights are as 
follows. 

a. The weight adjustment formula of output layer neurons which mathematical expression are given in 
Equation(5) 


Pp 
AO j, aa ny eg - Vo) pi (l— Vj) pk 
iss (5) 


where, n is the learning rate, whose general range is 0.1 - 0.3. 


b. The weight adjustment formula of each hidden layer neurons are explained in equation(6) 


P 
AV,; = De 2 Oni QO ix X nk d= Sok )X pi 
ee (6) 
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The basic idea of the BP algorithm is the learning process and can be divided into two stages: the 
first stage (forward propagation process), given input information through a layer by layer processing each 


hidden layer and calculate the actual output value of each unit of Y pi? the second stage (the reverse process), 


if the output layer fails to get the expected output value, then layer by layer recursively calculates the 
difference of error between the actual output and the expected output. The gradient descent method modifies 


the weights of the AV,; ; Ao, , making the total error function minimum. Table 1 displays the input 


parameters of network traffic to evaluate the proposed techniques. 


Table 1 Sample Input Parameters of Network Traffic 








Classification Example Application 
DATABASE postgres, sqlnet oracle, ingres 
INTERACTIVE ssh, klogin, rlogin, telnet 
MAIL imap, pop2/3, smtp 
SERVICES X11, dns, ident, Idap, ntp 
ATTACK Internet worm and virus attacks 
GAMES Microsoft Direct Play 

P2P KaZaA, BitTorrent, GnuTella 
MULTIMEDIA Windows Media Player, Real 
BULK ftp 

WWW www 





2.2. Flow Features-Classification input 

Flow metrics (duration, packet-count, total bytes) Packet inter-arrival time (mean, variance, Ist & 
3rd quartiles, median, minimum, maximum. Size of TCP/IP control fields (mean, variance, Ist & 3rd 
quartiles, median, minimum, maximum,). Total packets (in each direction and total for flow) Payload size 
(mean, variance, Ist & 3rd quartiles, median, minimum, maximum,. . . ). Effective Bandwidth Ranked list is 
top-ten fourier-transform components of packet inter-arrival times for each direction. Here, Table 2 explains 
the proposed classifier result of packet inter-arrival times in details. 


Table 2 Proposeed Classifier Result of Packet Inter-Arrival Times 








Algorithms Accuracy 
NN-BP 96.87 
NN-BP with Optimization 98.07 
NN-Structure optimized 99.05 





100 


99 


Accuracy 





NN-BP with 
Optimization 


NN-BP 


NN-Structure optimized 


Techniques Used 
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Figure 2. Comparison Analysis of Neural Network Algorithms 


Figure 2 shows the comparison of Neural Network Algorithms such as NN-BP, NN-BP with 
optimization and NN-structured optimization and it is clearly shown that the proposed mechanism NN-BP 
has higher accuracy of 99.05 estimated in terms of packet arrival times. 
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2.3. Important flow Routing 

In general router route the packets from one device to other device which are in different network, 
for forwarding packets it refers the routing table, routing table contains details about nearby routers 
information. For important flow routing, some additional information is used to store in routing table. In 
routing table IP address along with packet count for particular application and packet time stamp is updated 
in routing table periodically. Flow measurement statistics report provides packet count for particular 
application. Router route packets intelligently using this classification output. 


Traffic M easurement point 


oN Router with aN 
‘a ’ intelligent 
% i decision \ 





Figure 3. Important Flow Routing 


In Figure 3, networkl wants to transfer the packet to network2. The router route the packet 
intelligently using traffic classification output. In router priority scheduling algorithm is used to schedule the 
packet, based on priority packets importance is given then it is forwarded to respective destination. 


Incoming packets per-flowset counter 





Intelligent decision 


Figure 4. Routing Table Updatation 


Router incoming packets are measured and classified based on categorization algorithm, flow are 
formed as flow-groups. This flow-groups information is maintained by counter, for each matching flow- 
groups counter is incremented; the application packet count along with the packet time stamp is updated in 
routing table periodically as shown in Figure 4. Router while route the packet check how to reach the 
destination address, and also knows the application detail, which packet belongs to which application and 
how many packets forwarded for particular application, based on the intelligent information route the packet 
intelligently. If some application packets counts are forwarded more and other application packets are just 
started for transmission, router follows the priority algorithm first priority is given for application which have 
more packets count, other application transmission is denied, this denial of service is given only three times 
for particular application using aging concept. 
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3. | RESULTS AND ANALYSIS 
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Figure 5. Router performance without intelligence 


Router performance without intelligence is shown in Figure 5. Here the parameters such as speed, 
latency and throughput are plotted for existing system with respect to their network efficiency. 
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Figure 6. Router performance with intelligence 


Router performance with intelligence is shown in Figure 6. Here the parameters such as speed, 
latency and throughput are plotted for proposed system with respect to their network efficiency. Achieving 
higher throughput shows that better performance of the network. Table 3 expresses the proposed algorithm 
performance result in parameters wise. 
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Table 3. Parameters used for comparing router performance 








Parameters Router With Intelligence Router Without Intelligence 
Throughput (percent) 96.20% 72.50% 
Average Latency(microseconds) 53.2 152.3 
Misordered Packets(Percent) 0% 2.15% 
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Figure 7. Performance Comparison of Router With Intelligence and Without Intelligence 
Based on Load Offered 


Figure 7 demonstrates the performance comparison of router with intelligence and router without 
intelligence on basis of load offered to the network. The throughput of offered load for router with 
intelligence is better compared to the router without intelligence. 


4. CONCLUSION 

In router large volume of data can enter and leave, this huge amount of data is handled and 
classified by structure optimized neural network, the accuracy of proposed system is higher then traditional 
classification methods like port based ,deep packet inspection and statistical classification. This mechanism 
will improve router efficiency by increased throughput and decreased latency. Also proposed method is used 
by the administrator for taking good control decision about the network activities, classification of 
application usage and style, anomaly detection and accounting. 
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